Method of diagnosing main relay by use of electronic control unit and electronic control unit

ABSTRACT

The electronic control unit includes a control section monitoring a manipulation of an ignition switch of a vehicle and a timer section for automatically starting up said control section. The electronic control unit is provided with a fault diagnosis function of monitoring, by use of the control section, a state of an electric load connected to said electronic control unit and supplied with electric power from the vehicle battery when the main relay is in the on state after the control section outputs the stop command, and diagnosing whether or not the main relay is in a fault state where the main relay cannot be controlled from the on state to the off state on the basis of monitored state of the electric load.

CROSS-REFERENCE TO RELATED APPLICATION

This application is related to Japanese Patent Application No.2005-137724 filed on May 10, 2005, the contents of which are herebyincorporated by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a method of diagnosing presence of afault in a main relay used for controlling supply of electric power toelectric loads such as a microcomputer of an electronic control unit andvarious actuators mounted on a vehicle, and relates to an electroniccontrol unit having a function of performing a fault diagnosis on such amain relay.

2. Description of Related Art

Most engine systems mounted on vehicles are provided with aself-diagnosis function. Such engine systems are configured to perform aself-diagnosis during a period when a vehicle engine is in a state wherethere is no fear of making a wrong diagnosis.

However, it often occurs that the time during which the vehicle engineis kept at the state where there is no fear of making a wrong diagnosisis too short to perform the self-diagnosis, depending on the contents ofthe self-diagnosis (diagnosis targets). One of such diagnosis targets isthe evapo-purge system described, for example, in Japanese PatentApplication Laid-open No. 8-35452.

The evapo-purge system is a system for collecting fuel steam evaporatingfrom a fuel tank into a canister, and purging the collected fuel steaminto an air intake passage of a vehicle engine together with fresh airsucked through an atmospheric hole of the canister depending on arunning state of the vehicle engine. The evapo-purge system is mainlyconstituted by the canister, an evapo-passage for communication betweenthe fuel tank and the canister, and a purge passage for communicationbetween the canister and the air intake passage. To diagnose theevapo-purge system, the system is set in a closed state, and then acertain pressure is applied to the inside of this system. Abnormality inthe evapo-purge system, that is, leakage due to a hole or a crack(mainly in the evapo-passage or the purge passage) can be detected bymonitoring how the pressure inside the system varies when theapplication of the pressure to the inside of this system is removed.

If the fuel in the fuel tank is vibrated, or if the temperature of thefuel changes while the self-diagnosis is performed, the abnormalitydetection reliability may be degraded, because the fuel vibration andthe fuel temperature change have a nonnegligible effect on the pressureinside the system.

Accordingly, it is known to configure an electronic control unit havinga function of performing a self-diagnosis such that it automaticallyrestarts in order to perform the self-diagnosis after a lapse of apredetermined time from the time when an ignition switch was turned offto stop a vehicle engine (refer to Japanese Patent Application Laid-openNo. 2003-254172, for example).

Such an electronic control unit includes therein a soak timer. When thesoak timer in which a predetermined timer time (start-up set time) isset is timed-up, a main relay is energized (turned on), as a result ofwhich electric power is supplied to a microcomputer of the electroniccontrol unit so that the electronic control unit can perform theself-diagnosis.

In such an electronic control unit, if the main relay develops a faultin that the main relay is always in the on state due to abnormality in arelay drive circuit, or the soak timer, or the main relay itself, it mayresult that the remaining capacity of a vehicle battery keeps decreasingand runs out at the worst time, because the supply of electric power tothe electronic control unit continues.

SUMMARY OF THE INVENTION

The present invention provides a method of diagnosing presence of afault in a main relay by use of an electronic control unit including acontrol section monitoring a manipulation of an ignition switch of avehicle, and a timer section for automatically starting up the controlsection, the electronic control unit being configured to control themain relay to an on state for supplying the control section withelectric power from a vehicle battery when the ignition switch is turnedon or when the timer section in which a predetermined start-up set timeis set is timed up, and to control the main relay to an off state inaccordance with a stop command outputted from the control section, themethod including the steps of:

monitoring, by use of the control section, a state of an electric loadconnected to the electronic control unit and supplied with electricpower from the vehicle battery when the main relay is in the on stateafter the control section outputs the stop command; and

diagnosing whether or not the main relay is in a fault state where themain relay cannot be controlled from the on state to the off state onthe basis of monitored state of the electric load.

The present invention also provides An electronic control unitincluding:

a control section monitoring a manipulation of an ignition switch of avehicle; and

a timer section for automatically starting up the control section;

the electronic control unit being configured to control the main relayto an on state for supplying the control section with electric powerfrom a vehicle battery when the ignition switch is turned on or when thetimer section in which a predetermined start-up set time is set is timedup, and to control the main relay to an off state in accordance with astop command outputted from the control section, and being provided witha fault diagnosis function of monitoring, by use of the control section,a state of an electric load connected to the electronic control unit andsupplied with electric power from the vehicle battery when the mainrelay is in the on state after the control section outputs the stopcommand, and diagnosing whether or not the main relay is in a faultstate where the main relay cannot be controlled from the on state to theoff state on the basis of monitored state of the electric load.

The fault diagnosis function may be configured to make an attempt todrive the electric load by use of the control section to monitor anoperation state of the electric load when the attempt is made.

The stop command outputted from the control section may be inputted to adrive circuit of the main relay by way of the timer section, and thefault diagnosis function may be configured to make the attempt utilizinga time period after transmission of the stop command from the controlsection to the timer section.

The stop command outputted from the control section may be directlyinputted to a drive circuit of the main relay, and the fault diagnosisfunction may be configured to make the attempt utilizing a time periodafter transmission of the stop command from the control section to adrive circuit of the main relay.

The fault diagnosis function may be configured to make, if the electricload is normally driven when the attempt is made, the attempt for thesecond time, and to determine that the main relay is in the fault stateif the electric load is normally driven when the attempt is made for thesecond time.

The fault diagnosis function may be configured to make, if the electricload is normally driven when the attempt is made, a diagnosis ofpresence of a breakage fault in a power supply path of the electric loadon the basis of followability of the electric load to the drive command.

The fault diagnosis function may be configured to make, if the electricload is normally driven when the attempt is made, a diagnosis ofpresence of a breakage fault in a power supply path of the electric loadon the basis of a value of a current flowing into the electric loadthrough the power supply path.

The fault diagnosis function may be configured to monitor a time elapsedsince the control section transmits the stop command by use of thecontrol section, the attempt being made when the monitored elapsed timeexceeds a threshold time set at a value determined depending on aresponse time needed for the main relay to change from the on state tothe off state in response to the stop command.

The threshold time may be a sum of the response time and a predeterminedmargin time.

The fault diagnosis function may be configured to, when a diagnosis thatthe main relay is in the fault state is made, notify a result of thediagnosis, and store the result of the diagnosis in a nonvolatile memoryincluded in the electronic control unit.

The fault diagnosis function is configured to, when a diagnosis that themain relay is in the fault state is made, transmit a result of thediagnosis as a fail-safe command to other electronic control unitsthrough an in-vehicle network.

The control section and the timer section may be separately formed indifferent IC chips.

The control section and the timer section may be integrated in the sameIC chip.

According to the present invention, it becomes possible to earlydiagnose presence of a fault in the main relay or in its control line.

BRIEF DESCRIPTION OF THE DRAWINGS

In the accompanying drawings:

FIG. 1 is a block diagram showing structures of an electronic controlunit according to a first embodiment of the invention and its peripheralcircuits;

FIG. 2 is a flowchart showing processing steps of a control processperformed by a microcomputer included in the electronic control unitaccording to the first embodiment of the invention;

FIG. 3 is a flowchart showing steps of a base load fault judgingprocessing included in the control process performed by themicrocomputer included in the electronic control unit according to thefirst embodiment of the invention;

FIG. 4 is a flowchart showing steps of a main relay cut-off processingincluded in the control process performed by the microcomputer includedin the electronic control unit according to the first embodiment of theinvention;

FIG. 5 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when an ignition switch is turned off;

FIG. 6 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when then ignition switch is turned off;

FIG. 7 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when then ignition switch is turned off;

FIG. 8 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when then ignition switch is turned off;

FIG. 9 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when an ignition switch is turned off;

FIG. 10 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the first embodiment ofthe invention when the ignition switch is turned off;

FIG. 11 is a flowchart showing processing steps of a control processperformed by a microcomputer included in the electronic control unitaccording to a first embodiment of the invention;

FIG. 12 is a flowchart showing steps of a main relay cut-off processingincluded in the control process performed by the microcomputer includedin the electronic control unit according to the second embodiment of theinvention;

FIG. 13 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the second embodimentof the invention when an ignition switch is turned off;

FIG. 14 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the second embodimentof the invention when the ignition switch is turned off;

FIG. 15 is a timechart showing temporal changes of each signal and eachpart in the electronic control unit according to the second embodimentof the invention when an ignition switch is turned off; and

FIG. 16 is a block diagram showing a structure of a variant of theelectronic control unit according to the first embodiment of theinvention.

PREFERRED EMBODIMENTS OF THE INVENTION First Embodiment

FIG. 1 is a diagram showing structures of an electronic control unit 100according to a first embodiment of the invention, and its peripheralcircuits.

As shown in this figure, an indicating lamp 108, an ignition switch 201,a main relay 202, a vehicle battery 203, an electric load 301 such as ancooling fan, etc, are connected to the electronic control unit 100 asits peripheral circuits.

The electronic control unit 100 is mainly constituted by a microcomputer101, a nonvolatile memory 102 connected to the microcomputer 101, a mainrelay drive circuit 103, a power supply circuit 104, a soak timer 105,an input/output section 106, a communication circuit 107, and anelectric load drive circuit 302 for driving the electric load. Theelectronic control unit 100 is connected to an in-vehicle network suchas CAN (Controller Area Network) through the communication circuit 107so as to be capable of communicating with other electronic control unitsmounted on the same vehicle. The electric load drive circuit 302 isconstituted by a power transistor and load resistors.

The microcomputer 101 has an external load terminal TM connected to anode between the electric load 301 and the electric load drive circuit302 through a pick-up path 303.

The microcomputer 101 of the electronic control unit 100 includes a CPUmonitor RAM 101 b which is a volatile memory, and a communicationsection 101 c.

The microcomputer 101 operates as a host computer of the electroniccontrol unit 100 to perform an engine control process under normalconditions, and other various processes including a diagnosis processfor the evapo-purge system. The microcomputer 101 also includes a faultdiagnosis section 101 a for performing a fault diagnosis on the mainrelay 202 and its control line including the main relay drive circuit103 and the soak timer 105.

The microcomputer 101 is configured to transmit a cut-off request signal(power supply interruption command) SD to the soak timer 105 through thecommunication section 101 c to turn off the main relay 202, when theignition switch 201 is turned off, and when the fault diagnosis on theevapo-purge system is completed. The microcomputer 101 is alsoconfigured to make an attempt to drive the electric load 301 byoutputting a drive command to the electric load drive circuit 302utilizing a time period after the microcomputer outputs the cut-offrequest signal SD, and to monitor followability of the electric load tothe drive command. The fault diagnosis section 101 a is configured todiagnose whether or not the main relay 202 is in a state where it cannotbe controlled to the off state, and also diagnose whether or not thereis a breakage fault in a power supply path (cable) through whichelectric power is supplied to the electric load 301. When it isdiagnosed that the main relay 202 is in the state where it cannot becontrolled to the off state, the microcomputer 101 stores the result ofthis diagnosis in the nonvolatile memory 102, lights the indicating lamp108, and transmits a fail-safe command to other electronic control unitsthrough the communication circuit 107 to notify occurrence of the faultin the main relay 202.

The main relay drive circuit 103, which performs on/off control on themain relay 202, turns on the main relay 202 upon receiving a drivecommand SK which the soak timer 105 outputs when an ON signal SIG issent from the ignition switch 201, and when a timer counter 105 a (to bedescribed later) thereof is timed up. The main relay drive circuit 103turns off the main relay 202 upon receiving a stop command SH from thesoaktimer 105. The main relay 202 is constituted by a relay coil 202 aand a relay contact 202 b. When a drive current is passed through therelay coil 202 a by the main relay drive circuit 103, the relay contact202 b is closed, as a result of which a battery voltage VBAT is appliedto the power supply circuit 104 of the electronic control unit 100 as adrive voltage VB. When the drive current to the relay coil 202 a isinterrupted, the relay contact 202 b is opened, as a result of which theapplication of the drive voltage VB to the power supply circuit 104 isremoved.

The power supply circuit 104 generates an operation voltage Vm suppliedto the microcomputer 101 from the drive voltage BV, and also generatesan operation voltage Vs supplied to the main relay drive circuit 103,soak timer 105, etc. directly from the battery voltage VBAT.

The soak timer 105 is mainly constituted by the timer counter 105 a, aset-value holding section 105 b, a clock generator 105 c, and acommunication/control circuit 105 f. The soak timer 105 is configured tooperate on the drive voltage Vs supplied from the power supply circuit104 irrespective of the on/off state of the ignition switch 201.

The timer counter 105 a is configured to count oscillation signals(clocks) generated by the clock generator 105 c to measure time. Theset-value holding section 105 b is for holding a start-up set time TH ofthe soak timer 105 b. The set-value holding section 105 b can beconstituted by a register or the like.

The communication/control circuit 105 f of the soak timer 105 operatesas a communication interface for transmitting and receiving the start-upset time TH, a timer counter clear signal, the cut-off request signalSD, a reception acknowledge SR, etc. with the microcomputer 101. Thecommunication/control circuit 105 f includes a function of controllingrenewal of the start-up set time TH held in the set-value holdingsection 105 b, a function of controlling the counting operation of thetimer counter 105 a, and a function of controlling the main relay drivecircuit 103 by outputting the stop command SH in response to the cut-offrequest signal SD. More specifically, the communication/control circuit105 f is configured to rewrite the start-up set time TH held in theset-value holding section 105 b in accordance with instructionconcerning the start-up set time TH sent from the microcomputer 101, andto clear the timer counter 105 a upon receiving the timer counter clearsignal. The communication/control circuit 105 f is also configured toreturn the reception acknowledge SR upon receiving the cut-off requestsignal from the microcomputer 101, while outputting the stop command SHto the main relay drive circuit 103.

The soak timer 105 compares the count value of the timer counter 105 awith the start-up set time TH held in the set-value holding section 105b by use of a comparator 105 d, and outputs the drive command SK to themain relay drive circuit 103 through an OR circuit 105 e when theycoincide to each other. The soak timer 105 outputs the drive command SKto the main relay drive circuit 103 through the OR circuit 105 e alsowhen the ON signal SIG is sent from the ignition switch 201.

The input/output section 106 of the electronic control unit 100 includesvarious interface circuits, an A/D converter circuit for convergingsensor signals into digital signals, various driver circuits, etc.Actuators and sensors for a various devices including fuel pump, anelectric pump module, a purge control valve, and a fuel injector, etc.are connected to the input/output section 106, so that they can becontrolled and monitored by the electric control unit 100. Theindicating lamp 108 connected to the input/output section 106 is litwhen the fault diagnosis section 101 a of the microcomputer 101 makes adiagnosis that the main relay 202 is in the state where it cannot becontrolled to the off state. The indicating lamp 108 is installed in aplace easily visible from vehicle passengers, for example, in a meterpanel.

Next, the control process performed by the microcomputer 101 isexplained with reference to the flowchart shown in FIG. 2. This controloperation is performed at regular intervals, for example, every 100 ms.The control process begins by checking at step S10 whether or not thestart-up of the microcomputer 101 itself has been caused by the actionof the soak timer 105. This check is made taking account of whether ornot the ignition switch 201 is in the off state where the On signal SIGis not received by the microcomputer 101.

If it is determined that the start-up of the microcomputer 101 has notbeen caused by the action of the soak timer 105, but caused by themanipulation of the ignition switch 201, a base process boxed by thebroken line in FIG. 2 is performed. This base process begins by checkingat step S11 whether the ignition switch 201 is switched from the onposition to the off position. If it is determined at step S11 that theignition switch 201 is in the on position (NO in step S11), a normalengine control is performed at step S12.

On the other hand, if it is determined at step S11 that the ignitionswitch 201 has been just switched to the off position (YES in step S11),a post-processing including learning of a fully closed position in anelectronic throttle control, and writing of various learned values andnecessary data into the nonvolatile memory 102, which the microcomputer101 should perform before entering the stopped state, is performed atstep S13. After completion of the post-processing, it is checked at stepS14 whether or not the condition for turning off the main relay 202(main relay cut-off condition) is satisfied. If it is determined at stepS14 that the main relay cut-off condition is not satisfied, the controlprocess is ended for a time. The post-processing is performed repeatedlyuntil the main relay cut-off condition is satisfied. If it is determinedat step S14 that the main relay cut-off condition is satisfied, a baseload fault judging processing is performed at step S15. Here,explanation is made to the base load fault judging processing withreference to the flowchart shown in FIG. 3.

The base load fault judging processing begins by picking up, at stepS151, a voltage at a ground terminal of the electric load 301, that is,a voltage applied to the external load terminal TM of the microcomputer101. Subsequently, it is checked at step S152 whether or not the pickedup voltage is equal to or larger than a predetermined level. Normally,the electric load 301 is applied with the drive voltage VB when the mainrelay 202 is in the on state. However, if there occurs a breakage faulton a power supply path between the main relay 202 and the electric load301, the application of the drive voltage VB to the electric load 301 isinterrupted. Accordingly, the level of the picked up voltage depends onwhether or not there is a breakage fault on the power supply path. Morespecifically, it is checked at step S152 whether or not the voltagepicked up at the external load terminal is equal to the drive voltage VBsubtracted by a voltage drop of the electric load 301. If it isdetermined at step S152 that the picked up voltage is larger than thepredetermined level, it is determined at step S153 that there is notbreakage fault on the power supply path between the main relay 202 andthe electric load 301 to end the base load fault judging processing. Onthe other hand, if it is determined at step S152 that the picked upvoltage is smaller than the predetermined level, it is judged at stepS154 that there is a breakage fault or a short circuit to the ground onthe power supply path between the main relay 202 and the electric load301. And the result of this judgment is stored in the nonvolatile memory102 to end the base load fault judging processing.

Returning to FIG. 2, when the base load fault judging processing iscompleted, the control process moves to step S16 to perform a main relaycut-off processing. Here, the explanation is made to the main relaycut-off processing with reference to the flowchart shown in FIG. 4.

As shown in this figure, the main relay cut-off processing begins bychecking at step S161 whether or not the cut-off request signal SD hasbeen transmitted to the soak timer 105. If it is determined at step S161that the cut-off request signal SD has not been transmitted, the cut-offrequest signal SD is transmitted through the communication section 101 cat step S162. At this time, the timer counter clear signal commanding toclear the count value of the timer counter 105 a of the soak timer 105is also transmitted.

After that, it is checked at step S163 whether or not the receptionacknowledgement SR has been transmitted from the soak timer within apredetermined time. If it is determined at step S163 that the receptionacknowledge SR has been returned from the soak timer 105 within apredetermined time, the processing is ended for a time. In such a normalcase, the stop command SH is outputted from the soak timer 105, and as aresult the application of the operation voltage Vm to the microcomputer101 is interrupted, because the relay drive circuit 103 control the mainrelay 102 to the off state. In this way, the microcomputer 101 entersthe stopped sate after a lapse of a predetermined time from the timewhen the cut-off request signal SD is transmitted at step S162.

On the other hand, if it is determined at step S163 that the receptionacknowledge SR has not been returned from the soak timer 105 within thepredetermined time, the result of this check indicating that there isfault or abnormality in the soak timer 105 is stored in the nonvolatilememory 102 at step S164, and then notified to the vehicle passengersthrough illumination of the indicating lamp 108 at step S165. In thiscase, since the possibility that the main relay 202 cannot be controlledto the off state is high, the result of this check is transmitted toother electronic control units connected to the in-vehicle network, sothat they can operate in a fail-safe mode taking account of the factthat there is abnormality in the soak timer 105.

In the case where the main relay 202 cannot be controlled to the offstate when the cut-off request signal SD is transmitted to the soaktimer 105 due to abnormality in the control line of the main relay 202,the main relay cut-off processing continues even after transmission ofthe cut-off request signal SD, because the supply of electric power tothe microcomputer 101 continues. In this case, since the transmission ofthe cut-off request signal SD has been already done, the check result atstep S161 becomes affirmative (YES), it is checked at step S166 whetheror not the nonvolatile memory 102 stores a fault record (abnormalityrecord). If it is determined that at step S166 that the nonvolatilememory 102 stores a fault record (abnormality record), the processing isended for a time.

On the other hand, if it is determined that at step S166 that thenonvolatile memory 102 stores no fault record (no abnormality record),an attempt is made to drive the electric load 301 by outputting thedrive command to the electric load drive circuit 302 at step S167. Atthis time, the value of a voltage picked up at the external loadterminal TM is stored in the CPU monitor RAM 101 b at step S168.Incidentally, when the main relay 202 is changed to the off state inresponse to the cut-off request signal, the attempt to drive theelectric load 301 is not made, because the supply of electric power tothe microcomputer 101 is interrupted. Accordingly, since if the attemptto drive the electric load 301 is made, it means that the supply ofelectric power to the microcomputer 101 is continuing, it is diagnosedthat there is a fault in the main relay 202 or in its control line. Inthis embodiment, it is also diagnosed whether or not a breakage fault isin a power supply path leading from the node between the electric load301 and the electric load drive circuit 302 to the ground as explainedbelow.

After the pick-up of the voltage at the external load terminal TM isperformed for a predetermined time, it is checked at step S169 whetheror not the voltage picked up is following the drive command by comparingthe phase of the picked up voltage with the phase of the drive command.If it is determined at step 169 that the voltage picked up is followingthe drive command, it is judged that there is not a break in the powersupply path leading from the node (pick up point) between the electricload 301 and the electric load drive circuit 302 to the ground, nor afault in the power transistor of the electric load drive circuit 302.And the result of this judgment is stored in the nonvolatile memory 102at step S170. The result of this judgment is also notified to thevehicle passengers through illumination of the indicating lamp 108, andtransmitted as a fail-safe command to other electronic control unitsconnected to the in-vehicle network at step S171, to complete thisprocessing. On the other hand, if it is determined at step S169 that thevoltage picked up is not following the drive command, it is judged atstep S172 that there is a break in the electrical path, or a fault inthe power transistor of the electric load drive circuit 302. The resultof this judgment is notified to the vehicle passengers throughillumination of the indicating lamp 108, and is transmitted as afail-safe command to other electronic units at step S171 to complete themain relay cut-off processing. In this way, it becomes possible toperform the fault diagnosis on the main relay 202 and its control line,while performing the diagnosis to determine whether or not there is abreak or the like in the power supply path.

On the other hand, if it is determined at step S10 in FIG. 2 that thestart-up of the microcomputer 101 has been caused by the action of thesoak timer 105, it is checked at step S17 whether the microcomputer 101has been started up in a state where the supply of electric power to themicrocomputer 101 has been maintained. In other words, it is checked atstep S17 whether or not the main relay 202 was turned off normally bythe manipulation of the ignition switch 201, and then the microcomputer101 was started up by the action of soak timer 105. If it is determinedat step S17 that the microcomputer 101 has been started up in a statewhere the supply of electric power has been maintained, that is, if itis determined that the main relay 202 is already in a state where itcannot be controlled to the off state, the control process is endedwithout performing the fault diagnosis process on the evapo-purgesystem. Incidentally, the diagnosis that there is fault in the mainrelay 202 has been already made by the above explained main relaycut-off processing. On the other hand, if it is determined at step S17that the microcomputer 101 has been started up in a state where thesupply of electric power has not been maintained, the fault diagnosisprocessing on the evapo-purge system is performed at step S18. If anyfault is detected at step S18, the result of this diagnosis is stored inthe nonvolatile memory 102, and electric loads such as a throttle valveare returned to their starting states.

After that, it is checked at step S19 whether or not the fault diagnosisprocessing on the evapo-purge system has been completed. If it isdetermined that the fault diagnosis processing on the evapo-purge systemhas been completed, a base load fault judging processing, which is thesame as the base load fault judging processing at step S15, is performedat step S20 to complete the control process. Subsequently, a main relaycut-off processing, which is the same as the main relay cut-offprocessing at step S16, is performed at step S21 to complete the controlprocess. As explained above, since the main relay cut-off processing isperformed even after the fault diagnosis on the evapo-purge system iscompleted, the fault diagnosis on the main relay 202 can be performedafter the microcomputer 101 is started up by the action of the soaktimer 105.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 5 for a case where there is no breakage in the power supplypath, and there is no fault in the main relay 202 or in its controlsystem, and the main relay 202 is in the state where it can becontrolled to the off state.

As shown in the timechart of FIG. 5, when the ignition switch 201 isswitched from the off position to the on position at timing t1, themicrocomputer 101 performs the above described post-processing includingtransmission of the cut-off request signal SD to the soak timer 105 (see(h) in FIG. 5). When the post-processing is completed at timing t2, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD, as a result of which themain relay 202 is changed to the off state (see (b), (c) in FIG. 5).Also, at this timing t2, the timer counter 105 a is cleared inaccordance with the timer counter clear signal sent from themicrocomputer 101, and the soak timer 105 starts clocking (see (d) inFIG. 5). Incidentally, the output of the drive command to the electricload drive circuit 302, and the storing of the voltage picked up at theexternal load terminal TM into the CPU monitor RAM 101 b are notperformed (see (e), (f) in FIG. 5), because the microcomputer 101 entersthe stopped state with the change of the main relay 202 into the offstate. Accordingly, a diagnosis that the main relay 202 is in the statewhere it can be normally controlled to the off state is made (see (g) inFIG. 5).

When the count value of the timer counter 105 a exceeds the start-up settime TH at timing t3 (see (d) in FIG. 5), the main relay 202 iscontrolled to the on state by the action of the soak timer 105, as aresult of which the microcomputer 101 is applied with the operationvoltage Vm. After the microcomputer 101 is started up in this way, thefault diagnosis processing on the evapo-purge system is performed (see(h) in FIG. 5). When this fault diagnosis processing is completed attiming t4, the above described post-processing including communicationwith the soak timer 105 is performed at timing t4. As a result, the mainrelay 202 is changed to the off state in response to stop of output ofthe drive command SK to the main relay drive circuit 103 (see (b), (c)in FIG. 5), and the microcomputer 101 enters the stopped state again.Accordingly, also in this case, it is diagnosed that the main relay 202is normally controlled to the off state (see (g) in FIG. 5). It shouldbe noted that when the ignition switch 201 is switched to the on stateat timing t6, the microcomputer 101 starts performing a normal enginecontrol after performing a specific initialization process (not shown).

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 6 for a case where there is no breakage in the power supplypath, but there is a fault in the main relay 202 or in its controlsystem when the ignition switch 201 is switched to the off position.

As shown in the timechart of FIG. 6, when the ignition switch 201 isswitched from the on position to the off position at timing t11, themicrocomputer 101 performs the above described post-processing includingtransmission of the cut-off request signal SD to the soak timer 105 (see(h) in FIG. 6). When the post-processing is completed at timing t12, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 5). Also,at this timing t12, the timer counter 105 a is cleared in accordancewith the timer counter clear signal sent from the microcomputer 101, andthe soak timer 105 starts clocking (see (d) in FIG. 5). However, ifthere is a fault in the main relay 202 at this moment, an attempt todrive the electric load 301 by outputting the drive command to theelectric load 302 circuit 302 is made (see (e) in FIG. 6), because themain relay 202 is kept at the on state irrespective of the stop ofoutput of the drive command SK by the action of the soak timer 105 (see(c) in FIG. 5). And the voltage picked up at the external load terminalTM is stored in the CPU monitor RAM 101 b (see (f) in FIG. 6). Thevoltage picked up at the external load terminal TM follows the drivecommand as long as there exists no breakage fault in the power supplypath of the electric load 301. Accordingly, it is diagnosed that themain relay 202 is in the state where it cannot be controlled to the offstate, although there exists no breakage fault in the power supply pathat timing t13 (see (g) in FIG. 6). The result of this diagnosis iswritten into the nonvolatile memory 102, and is notified to the vehiclepassengers through illumination of the indicating lamp 108 (see (h) inFIG. 6). Although not shown in FIG. 6, the result of this diagnosis isalso transmitted as a fail-safe command to other electronic controlunits connected to the in-vehicle network. It should be noted that whenthe ignition switch 201 is switched to the on position at timing t16,the microcomputer 101 starts performing the normal engine control afterperforming a specific initialization process (not shown) if the vehiclebattery is in a condition to supply electric power.

Incidentally, it is preferable to transmit the cut-off request signal SDand to make again an attempt to drive the electric load 301 utilizing atime period after transmission of this cut-off request signal SD, whenthe electric load 301 is normally driven by making the attempt to drivethe electric load 301 in view of improving reliability of the faultdiagnosis on the main relay 202. That is because, it is knownempirically that the main relay 202 is often recovered by retransmittingthe cut-off request signal SD when the main relay 202 cannot becontrolled to the off state only temporarily by contact sticking, forexample. Accordingly, if the electric load 301 is normally driven by theretransmission (retry) of the cut-off request signal SD from themicrocomputer 101, it means that there is high possibility that thereoccurs an unrecoverable fault in the main relay 202 or in its controlline.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when such aretry (retransmission) of the cut-off request signal SD is performedwith reference to the timechart shown in FIG. 7.

Also in this case, if there is a fault in the main relay 202 or in itscontrol line, the voltage picked up at the external load terminal TMfollows the drive command for a time period between timing t12 andtiming t13 (see (e), (f) in FIG. 7). However, the diagnosis that thereis a fault in the main relay 202 is not made promptly, but is put onhold (see (g) in FIG. 7), because the cut-off request signal SD isretransmitted and the attempt to drive the electric load 301 byoutputting the drive command to the electric load drive circuit 302 ismade again during a time period between timing t13 and timing t14. Ifthe main relay 202 is changed to the off state by this retransmission ofthe cut-off request signal SD, the supply of electric power to themicrocomputer 101 is interrupted, and accordingly the diagnosis thatthere is a fault in the main relay 202 is not made.

On the other hand, if the main relay 202 is not changed to the off stateby this retransmission of the cut-off request signal SD, the attempt todrive the electric load 301 is made again. If it is determined at timingt15 that the voltage picked up at the external load terminal TM followsthe drive command, it is diagnosed that the main relay is in the statewhere it cannot be controlled to the off state. By retransmitting thecut-off request signal SD, the reliability of the fault diagnosis on themain relay 202 can be enhanced. Although the number of times oftransmission of the cut-off request signal SD followed by the attempt todrive the electric load 301 is set at two in this embodiment, it may beset at different number.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 8 for a case where there is a breakage in the power supply path,and there occurs a fault in the main relay 202 or in its control systemafter the ignition switch is switched to the off position.

As shown in the timechart of FIG. 8, when the ignition switch 201 isswitched from the on position to the off position at timing t21, themicrocomputer 101 performs the above described post-processing includingtransmission of the cut-off request signal SD to the soak timer 105 (see(h) in FIG. 8). When the post-processing is completed at timing t22, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 8). Also,at this timing t22, the timer counter 105 a is cleared in accordancewith the timer counter clear signal sent from the microcomputer 101, andthe soak timer 105 starts clocking (se (d) in FIG. 8). However, if thereis a fault in the main relay 202 at this moment, the attempt to drivethe electric load 301 by outputting the drive command to the electricload drive circuit 302 is made (see (e) in FIG. 8), because the mainrelay 202 is kept at the on state irrespective of the stop of output ofthe drive command SK by the action of the soak timer 105 (see (c) inFIG. 8). At this time, the value of the voltage picked up at theexternal load terminal TM is stored in the CPU monitor RAM101 b. Whenthere is a fault in the power supply path of the electric load 301, thepicked up voltage stored in the CPU monitor RAM 101 b is kept unchanged(see (f) in FIG. 8). That is, when there is a fault in the power supplypath of the electric load 301, the picked up voltage does not follow thedrive command. Accordingly, it is diagnosed that the main relay 202 isin the state where it cannot be controlled to the off state, and thereis also a breakage fault in the power supply path at timing t23 (see (g)in FIG. 8). The result of this diagnosis is written into the nonvolatilememory 102, and is notified to the vehicle passengers throughillumination of the indicating lamp 108 (see (h) in FIG. 8). Althoughnot shown in FIG. 8, the result of this diagnosis is also transmitted asa fail-safe command to other electronic control units connected to thein-vehicle network. It should be noted that when the ignition switch 201is switched to the on position at timing t24, the microcomputer 101starts performing the normal engine control after performing a specificinitialization process (not shown) if the vehicle battery is in acondition to supply electric power. Although not shown in FIG. 8, aretry processing such as shown in FIG. 7 may be performed.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 9 for a case where there is not breakage fault on the powersupply path of the electric load 301 but there occurs a fault in themain relay 202 or in its control line after the microcomputer 101 isstarted up by the action of the soak timer 105.

As shown in the timechart of FIG. 9, when the ignition switch 201 isswitched from the on position to the off position at timing t31, themicrocomputer 101 performs the above described post-processing (see (h)in FIG. 9). When the post-processing is completed at timing t32, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 9). Also,at this timing t32, the timer counter 105 a is cleared in accordancewith the timer counter clear signal sent from the microcomputer 101, andthe soak timer 105 starts clocking (see (d) in FIG. 9).

After that, when the count value of the timer counter 105 a exceeds thestart-up set time TH at timing t33 (see (d) in FIG. 9), the main relay202 is controlled to the on state by the action of the soak timer 105,as a result of which the microcomputer 101 is applied with the operationvoltage Vm (see (c) in FIG. 9). After the microcomputer 101 is startedup, the fault diagnosis processing on the evapo-purge system isperformed (see (h) in FIG. 9). When the fault diagnosis processing onthe evapo-purge system is completed at timing t34, the above describedpost-processing is performed. As a result, the output of the drivecommand SK is stopped at timing t35 (see (b) in FIG. 9). However, ifthere is a fault in the main relay 202 at this moment, an attempt todrive the electric load 301 by outputting the drive command to theelectric load circuit 302 is made (see (c) in FIG. 9), because the mainrelay 202 is kept at the on state irrespective of the stop of output ofthe drive command SK by the action of the soak timer 105 (see (e) inFIG. 9). And the voltage picked up at the external load terminal TM isstored in the CPU monitor RAM 101 b (see (f) in FIG. 9). The picked upvoltage follows the drive command as long as there exists no breakagefault in the power supply path of the electric load 301. Accordingly, itis diagnosed that the main relay 202 is in the state where it cannot becontrolled to the off state, although there exists no breakage fault inthe power supply path at timing t36 (see (g) in FIG. 9). The result ofthis diagnosis is written into the nonvolatile memory 102, and isnotified to the vehicle passengers through illumination of theindicating lamp 108 (see (h) in FIG. 9). Although not shown in FIG. 9,the result of this diagnosis is also transmitted as a fail-safe commandto other electronic control units connected to the in-vehicle network.It should be noted that when the ignition switch 201 is switched to theon position at timing t37, the microcomputer 101 starts performing thenormal engine control after performing a specific initialization process(not shown) if the vehicle battery is in a condition to supply electricpower. Although not shown in FIG. 9, a retry processing such as shown inFIG. 7 may be performed.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 10 for a case where there is a breakage in the power supplypath, and there occurs a fault in the main relay 202 or in its controlsystem after the microcomputer i101 is started up by the action of thesoak timer 105.

As shown in the timechart of FIG. 10, when the ignition switch 201 isswitched from the on position to the off position at timing t41, themicrocomputer 101 performs the above described post-processing (see (h)in FIG. 10). When the post-processing is completed at timing t42, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 10).Also, at this timing t42, the timer counter 105 a is cleared inaccordance with the timer counter clear signal sent from themicrocomputer 101, and the soak timer 105 starts clocking (see (d) inFIG. 10).

After that, when the count value of the timer counter 105 a exceeds thestart-up set time TH at timing t43 (see (d) in FIG. 10), the main relay202 is controlled to the on state by the action of the soak timer 105,as a result of which the microcomputer 101 is applied with the operationvoltage Vm (see (c) in FIG. 10). After the microcomputer 101 is startedup in this way, the fault diagnosis processing on the evapo-purge systemis performed (see (h) in FIG. 10). When this fault diagnosis processingis completed, the above described post-processing includingcommunication with the soak timer 105 is performed at timing t44. As aresult, the output of the drive command SK is stopped at timing t45 (see(b) in FIG. 10). However, if there is a fault in the main relay 202 atthis moment, the attempt to drive the electric load 301 by outputtingthe drive command to the electric load drive circuit 302 is made (see(c) in FIG. 10), because the main relay 202 is kept at the on stateirrespective of the stop of output of the drive command SK by the actionof the soak timer 105 (see (e) in FIG. 10). At this time, the value ofthe voltage picked up at the external load terminal TM is stored in theCPU monitor RAM101 b. The picked up voltage does not follow the drivecommand if there exists a breakage fault in the power supply path of theelectric load 301 (see (f) in FIG. 10). Accordingly, it is diagnosedthat the main relay 202 is in the state where it cannot be controlled tothe off state, and there is also a breakage fault in the power supplypath at timing t46 (see (g) in FIG. 10). The result of this diagnosis iswritten into the nonvolatile memory 102, and is notified to the vehiclepassengers through illumination of the indicating lamp 108 (see (h) inFIG. 10). Although not shown in FIG. 10, the result of this diagnosis isalso transmitted as a fail-safe command to other electronic controlunits connected to the in-vehicle network. It should be noted that whenthe ignition switch 201 is switched to the on position at timing t47,the microcomputer 101 starts performing the normal engine control afterperforming a specific initialization process (not shown) if the vehiclebattery is in a condition to supply electric power. Although not shownin FIG. 10, a retry processing such as shown in FIG. 7 may be performed.

The above described electronic control unit according to the firstembodiment of the invention provides advantages set forth below.

(1) The microcomputer 101 is configured to make an attempt to drive theelectric load 301 utilizing the time period after transmission of thecut-off request signal commanding the main relay 202 to be turned off.If the electric load 301 is normally driven at this time, a diagnosis onthe power supply path of the electric load 301 is made on the basis ofthe followability of the electric load 301 to the drive command. Thisenables a reliable fault diagnosis on the main relay 202 and its controlline. This also makes it possible to diagnose the presence of a breakagefault in the power supply path concurrently with the presence of a faultin the main relay 202 or its control line, to thereby enhance themaintainability of the electronic control unit.

(2) The cut-off request signal SD produced by the microcomputer 101 isinputted to the main relay drive circuit 103 by way of the soak timer105. Since the attempt to drive the electric load 301 is made when thecut-off request signal SD is not received by the main relay drivecircuit 103 due to fault in the soak timer 105, it is possible toperform the fault diagnosis on the main relay 202 taking account ofpossibility of a fault existing in the soak timer 105.

(3) The microcomputer 101 is configured to make an attempt again (retry)to drive the electric load 301 utilizing the time period aftertransmission of the cut-off request signal SD followed by the attempt todrive the electric load 301. This further improves the reliability ofthe fault diagnosis.

(4) When it is diagnosed that there is a fault in the main relay 202,the result of this diagnosis is written into the nonvolatile memory 102,and is also notified to the vehicle passengers through illumination ofthe indicating lamp 108. This makes it possible for the vehicle driverto evacuate the vehicle to a nearby dealer shop or the like to avoidproblems such as overdischarge of the vehicle battery. Furthermore, byrefereeing to the contents of the nonvolatile memory 102, it is possibleto early analyze the cause of the fault.

(5) Also, when it is diagnosed that there is a fault in the main relay202, the result of this diagnosis is transmitted as a fail-safe commandto other electronic control units connected in the in-vehicle network.This makes it possible for other electronic control units to performappropriate fail-safe processings, for example, to prohibit performingsome normal processings and performing specific processings on apreferential basis in order to ensure a high fail-safe ability of theentire vehicle.

(6) The microcomputer 101 itself monitors the elapsed time after ittransmits the cut-off request signal SD. Accordingly, it is notnecessary to provide a specific circuit for monitoring the elapsed timefor performing the fault diagnosis on the main relay 202.

Second Embodiment

Next, an electronic control unit according to a second embodiment of theinvention is described with reference to FIG. 11 to FIG. 15. Thestructure of the second embodiment is basically the same as that of thefirst embodiment. However, the second embodiment is configured tomonitor the time elapsed since the microcomputer transmits the cut-offrequest signal, and to make an attempt to drive the electric load whenthe elapsed time exceeds a predetermined time.

The microcomputer 101 of the electronic control unit 100 of the secondembodiment is added by a delay counter 101 d shown by a dotted box (seeFIG. 1). The microcomputer 101 is configured to monitor the elapsed timeafter transmission of the cut-off request signal SD through count up(increment) of the delay counter 101 d, and to make an attempt to drivethe electric load 301 when the count value of the delay counter 101 dexceeds a set delay time (threshold time) DT to be explained later. Theset delay time DT, which is prestored in the fault diagnosis section 101a, is set at a value corresponding to a sum of a response time neededfor the main relay 202 to change to the off state in response to thecut-off request signal SD and a predetermined margin time.

Next, the control process performed by the microcomputer 101 isexplained with reference to the flowchart shown in FIG. 11. Themicrocomputer 101 in this embodiment operates basically in the same waywith the microcomputer 101 in the first embodiment. However, themicrocomputer 101 in this embodiment is configured to increment andmonitor the count value of the delay counter 101 d, and to clear thedelay counter 101 d as necessary.

The control process begins by checking at step S30 whether or not thestart up of the microcomputer 101 has been caused by the action of thesoak timer 105. If it is determined at step S30 that the start up of themicrocomputer 101 has not bee caused by the action of the soak timer105, and it is determined at step S31 that the ignition switch 201 ismaintained at the on state, the normal engine control is performed. Inthis embodiment, the delay counter 101 d is cleared when the normalengine control is started (step S33). When the ignition switch 201 isswitched to the off position (YES in step S31), the post-processing isperformed at step S34, and then it is checked at step S35 whether or notmain relay cut-off condition is satisfied. The delay counter 101 d iscleared also in a case where it is determined at step S35 that the mainrelay cut-off condition is not satisfied. In this way, the count valueof the delay counter 101 b is cleared periodically during a period afterthe microcomputer 101 is started up by turning on the ignition switch201 and before the main relay cut-off condition is satisfied. On theother hand, if is determined at step S35 that the main relay cut-offcondition is satisfied, the base load fault judging processing isperformed at step S36, and then a main relay cut-off processing (to beexplained later) is performed at step S37 to complete the controlprocess.

On the other hand, if it is determined at step S30 that the start-up ofthe microcomputer 101 has been caused by the action of the soak timer105, it is checked at step S38 whether the microcomputer 101 has beenstarted up in a state where the supply of electric power to themicrocomputer 101 has been maintained. If it is determined at step S38that the microcomputer 101 has been started up in a state where thesupply of electric power has been maintained, the control process isended. Otherwise, the fault diagnosis processing on the evapo-purgesystem is performed at step S39. After that, it is checked at step S40whether or not the fault diagnosis processing on the evapo-purge systemhas been completed. If it is determined that the fault diagnosisprocessing on the evapo-purge system has been completed, the base loadfault judging process is performed at step S41, and then the main relaycut-off processing is performed at step S42 to complete the controlprocess.

Here, explanation is made to the main relay cut-off processing performedat step S37 and at step S42. As shown in FIG. 12, the main relay cut-offprocessing in this embodiment begins by checking at step S371 whether ornot the cut-off request signal SD has been transmitted to the soak timer105. If it is determined at step S371 that the cut-off request signal SDhas not been transmitted to the soak timer 105, the count value of thedelay counter 101 d is cleared at step S372, and the cut-off requestsignal SD is transmitted from the communication section 101 c at stepS373. At this time, the timer counter clear signal is also transmitted.

After that, steps S374 to S376 equivalent to steps S163 to S165 shown inFIG. 4 are performed.

More specifically, it is checked whether or not there is abnormality inthe soak timer 105 on the basis of the presence or absence of thereception acknowledge SR to be returned in response to the cut-offrequest signal SD. If it is determined that there is abnormality in thesoak timer 105, the result of this check is written into the nonvolatilememory 102. After that, the result of this check is notified to thevehicle passengers through illumination of the indicating lamp 108, andis also transmitted as a fail-safe command.

In the case where the main relay 202 cannot be controlled to the offstate even when the cut-off request signal SD is transmitted to the soaktimer 105 due to abnormality in the main relay 202 or in its controlline, the main relay cut-off processing continues even aftertransmission of the cut-off request signal SD, because the supply ofelectric power to the microcomputer 101 continues. In this case, sincethe transmission of the cut-off request signal SD has been already done,and accordingly the check result at step S371 becomes affirmative (YES),it is checked at step S377 whether or not the nonvolatile memory 102stores a fault record (abnormality record). If it is determined that atstep S377 that the nonvolatile memory 102 stores a fault record(abnormality record), the processing is ended for a time.

If it is determined that at step S377 that the nonvolatile memory 102does not store a fault record (abnormality record), the delay counter101 d is incremented by one at step S378. Accordingly, also in thisembodiment, the time elapsed since the microcomputer 101 transmitted thecut-off request signal SD is monitored on the basis of the count valueof the delay counter 101 d which is continuingly incremented.

After that, it is checked at step S379 whether or not the count value ofthe delay counter 101 d exceeds the set delay time DT at step S379. Itshould be noted that, during a period in which the count value of thedelay counter 101 d is determined not to exceed the set delay time DT,the main relay cut-off processing is performed repeatedly as long as thesupply of electric power to the microcomputer 101 is not interrupted. Ifit is determined at step S379 that the count value of the delay counter101 d exceeds the set delay time DT, that is, if it is determined thatthe supply of electric power to the microcomputer 101 is continuing, itis tried to drive the electric load 301 by outputting the drive commandto the electric load drive circuit 302 at step S380. At this time, thevalue of a voltage picked up at the external load terminal TM is storedin the CPU monitor RAM101 b at step S381.

After the pick-up of the voltage at the external load terminal TM isperformed for a predetermined time, it is checked at step S382 whetheror not the voltage picked up is following the drive command by comparingthe phase of the voltage picked up with the phase of the drive command.If it is determined at step S382 that the voltage picked up is followingthe drive command, it is judged that there is not a break in the powersupply path leading from the node (pick up point) between the electricload 301 and the electric load drive circuit 302 to the ground, or afault in the power transistor of the electric load drive circuit 302.The result of this judgment is stored in the nonvolatile memory 102 atstep S383. The result of this judgment is notified to the vehiclepassengers through illumination of the indicating lamp 108, and istransmitted as a fail-safe command to other electronic units at stepS384 to complete the main relay cut-off processing. On the other hand,if it is determined at step S382 that the voltage picked up is notfollowing the drive command, it is judged at step S385 that there is abreak in the electrical path, or a fault in the power transistor of theelectric load drive circuit 302. The result of this judgment is notifiedto the vehicle passengers through illumination of the indicating lamp108, and is transmitted as a fail-safe command to other electronic unitsat step S384 to complete the main relay cut-off processing.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 13 for a case where there is no breakage in the power supplypath, and there is no fault in the main relay 202 or in its controlsystem, and the main relay 202 is in the state where it can becontrolled to the off state.

As shown in the timechart of FIG. 13, when the ignition switch 201 isswitched from the off position to the on position at timing t1, themicrocomputer 101 performs the above described post-processing, baseload fault judging processing, and communication with the soak timer 105including transmission of the cut-off request signal SD (see (i) in FIG.13). When the post-processing is completed at timing t2, the output ofthe drive command SK is stopped in response to the transmission of thecut-off request signal SD, as a result of which the main relay 202 ischanged to the off state (see (b), (c) in FIG. 13). Also, at this timingt2, the timer counter 105 a is cleared in accordance with the timercounter clear signal sent from the microcomputer 101, and the soak timer105 starts clocking (see (d) in FIG. 13). It should be noted that thecount value of the delay counter 101 d is incremented very little, andtherefore kept almost unchanged (see (e) in FIG. 13), because themicrocomputer 101 enters the stopped state with the change of the mainrelay 202 to the off state. At this time, the electric load 301 is notdriven (see (f) in FIG. 13), and a diagnosis that the main relay 202 isin the state where it can be normally controlled to the off state ismade (see (h) in FIG. 13).

When the count value of the timer counter 105 a exceeds the start-up settime TH at timing t3 (see (d) in FIG. 13), the main relay 202 iscontrolled to the on state by the action of the soak timer 105, as aresult of which the microcomputer 101 is applied with the operationvoltage Vm. After the microcomputer 101 is started up in this way, thefault diagnosis processing on the evapo-purge system is performed (see(i) in FIG. 13). When this fault diagnosis processing is completed attiming t4, the above described post-processing is performed at timingt5. As a result, the main relay 202 is changed to the off state inresponse to stop of output of the drive command SK to the main relaydrive circuit 103 (see (b), (c) in FIG. 13), and the microcomputer 101enters the stopped state again. Accordingly, also in this case, it isdiagnosed that the main relay 202 is in the state that it can benormally controlled to the off state (see (h) in FIG. 13). It should benoted that when the ignition switch 201 is switched to the on state attiming t6, the microcomputer 101 starts performing a normal enginecontrol after performing a specific initialization process (not shown).

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 14 for a case where there is no breakage in the power supplypath, but there is a fault in the main relay 202 or in its controlsystem when the ignition switch 201 is switched to the off position.

As shown in the timechart of FIG. 14, when the ignition switch 201 isswitched from the on position to the off position at timing t11, themicrocomputer 101 performs the above described post-processing (see (i)in FIG. 14). When the post-processing is completed at timing t12, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 14).Also, at this timing t12, the timer counter 105 a is cleared inaccordance with the timer counter clear signal sent from themicrocomputer 101, and the soak timer 105 starts clocking (see (d) inFIG. 14). However, if there is a fault in the main relay 202 at thismoment, the delay counter 101 d is incremented (see (e) in FIG. 14),because the main relay 202 is kept at the on state irrespective of thestop of output of the drive command SK by the action of the soak timer105 (see (c) in FIG. 14).

After that, when the count value of the delay counter 101 d exceeds theset delay time DT at timing t13, the drive command is outputted to theelectric load 301, and the voltage picked up at the external loadterminal TM is stored in the CPU monitor RAM 101 b (see (f) in FIG. 14).The picked up voltage follows the drive command as long as there existsno breakage fault in the power supply path of the electric load 301 (see(g) in FIG. 14). Accordingly, it is diagnosed that the main relay 202 isin the state where it cannot be controlled to the off state, althoughthere exists no breakage fault in the power supply path at timing t14(see (i) in FIG. 14). The result of this diagnosis is written into thenonvolatile memory 102, and is notified to the vehicle passengersthrough illumination of the indicating lamp 108 (see (i) in FIG. 14).Although not shown in FIG. 14, the result of this diagnosis is alsotransmitted as a fail-safe command to other electronic control unitsconnected to the in-vehicle network. It should be noted that when theignition switch 201 is switched to the on position at timing t15, themicrocomputer 101 starts performing the normal engine control afterperforming a specific initialization process (not shown) if the vehiclebattery is in a condition to supply electric power.

Next, explanation is made on the temporal changes of each signal andeach part of the electronic control unit of this embodiment when theignition switch 201 is turned on with reference to the timechart shownin FIG. 15 for a case where there is a breakage in the power supplypath, and there occurs a fault in the main relay 202 or in its controlsystem when the ignition switch is switched to the off position.

As shown in the timechart of FIG. 15, when the ignition switch 201 isswitched from the on position to the off position at timing t21, themicrocomputer 101 performs the above described post-processing (see (i)in FIG. 15). When the post-processing is completed at timing t22, theoutput of the drive command SK is stopped in response to thetransmission of the cut-off request signal SD (see (b) in FIG. 15).Also, at this timing t22, the timer counter 105 a is cleared inaccordance with the timer counter clear signal sent from themicrocomputer 101, and the soak timer 105 starts clocking (see (d) inFIG. 15). However, if there is a fault in the main relay 202 at thismoment, the delay counter 101 d is incremented (see (e) in FIG. 15).

After that, when the count value of the delay counter 101 d exceeds theset delay time DT, the drive command is outputted to the electric load301, and the voltage picked up at the external load terminal TM isstored in the CPU monitor RAM 101 b (see (f) in FIG. 15). When there isa fault in the power supply path of the electric load 301, the picked upvoltage stored in the CPU monitor RAM 101 b does not have an expectednormal value. That is, when there is a fault in the power supply path ofthe electric load 301, the picked up voltage does not follow the drivecommand. Accordingly, it is diagnosed that the main relay 202 is in thestate where it cannot be controlled to the off state, and there is alsoa breakage fault in the power supply path at timing t24 (see (h) in FIG.15). The result of this diagnosis is written into the nonvolatile memory102, and is notified to the vehicle passengers through illumination ofthe indicating lamp 108 (see (i) in FIG. 15). Although not shown in FIG.15, the result of this diagnosis is also transmitted as a fail-safecommand to other electronic control units connected to the in-vehiclenetwork. It should be noted that when the ignition switch 201 isswitched to the on position at timing t25, the microcomputer 101 startsperforming the normal engine control after performing a specificinitialization process (not shown) if the vehicle battery is in acondition to supply electric power.

The temporal changes of each signal and each part of the electroniccontrol unit of this embodiment in a case where there occurs a fault inthe main relay 202 after the microcomputer 101 is started up by theaction of the soak timer 105 are similar to those in the above describedcases explained with reference to the timecharts shown in FIG. 14 andFIG. 15. Also in this case, the delay counter 101 d is incremented afterthe microcomputer 101 outputs the cut-off request signal SD duringperforming the post-processing. Thereafter, when the count value of thedelay counter 101 d exceeds the set delay time DT, an attempt to drivethe electric load 301 is made, and the voltage picked up at the externalload terminal TM is stored in the CPU monitor RAM. Subsequently, thefault diagnosis on the main relay 202 and the diagnosis of presence of abreakage fault on the power supply path of the electric load 301 areperformed concurrently. If it is diagnosed that the main relay is in thestate where it cannot be controlled to the off state, the result of thisdiagnosis is written into the nonvolatile memory 102, notified to thevehicle passengers through illumination of the indicating lamp 108, andtransmitted as a fail-safe command to other electronic control unitsconnected to the in-vehicle network.

As explained above, the electronic control unit of the second embodimentprovides the following advantages in addition the advantages (1) to (6)provided by the electronic control unit of the first embodiment.

(7) The time elapsed since the microcomputer 101 transmits the cut-offsignal SD is monitored through the increment of the delay counter 101 d,and an attempt to drive the electric load 301 is made when the monitoredelapsed time exceeds the set delay time DT. This makes it possible toallow for the main relay 202 to be in a temporal fault state due tocontact sticking thereof, to further improve the reliability of thefault diagnosis on the main relay 202.

(8) The set delay time DT is set at a value corresponding to a sum of aresponse time needed for the main relay 202 to change to the off statein response to the cut-off request signal SD and a predetermined margintime. This makes it possible to absorb the variation of the responsetime, to thereby still further improve the reliability of the faultdiagnosis on the main relay 202.

It is a matter of course that various modifications can be made to theabove described embodiments as described below.

Although the elapsed time after transmission of the cut-off requestsignal SD from the microcomputer 101 is monitored through increment ofthe delay counter 101 d in the second embodiment, the elapsed time maybe monitored by a separately provided timer IC.

In the above described embodiments, the diagnosis on the presence of abreakage fault in the power supply path is performed on the basis of thefollowability of the voltage at the ground terminal of the electric load301. However, they may be so configured to measure a current flowingthrough the electric load 301 by use of a shunt resistor or the like,and to perform the diagnosis on the presence of a breakage fault in thepower supply path on the basis of the measured current when the electricload 301 is normally driven by the attempt to drive the electric load301 is made.

The stop command SH may be directly supplied from the microcomputer 101to the main relay drive circuit 103 as shown by the broken line in FIG.1, instead of the microcomputer 101 outputting the cut-off requestsignal SD to the soak timer 105, and the soak timer 105 outputting thestop command SH to the main relay drive circuit 103.

The breakage fault diagnosis on the power supply path of the electricload 301 may be made on the basis of the level of the voltage picked upat the external load terminal TM when the electric load 301 is normallydriven by the attempt to drive the electric load 301 is made. In thiscase, the base load fault judging processing can be removed.

The fault diagnosis on the main relay 202 is performed on the basis ofwhether the electric load 301 is normally driven when the attempt todrive the electric load 301 is made after the microcomputer 101transmits the cut-off request signal in the above described embodiments.However, the electronic control unit 100 may be so configured to monitorthe voltage applied to the electric load 301 after the microcomputer 101transmits the cut-off request signal SD, and to make the fault diagnosison the main relay 202 on the basis of whether or not the monitoredvoltage is equal to a voltage to be applied to the electric load 301when the main relay 202 is in the on state. That is because, since thevoltage applied to the electric load 301 and the resistance valuethereof change depending on whether the main relay 202 is in the onstate or the off state, it is possible to diagnose whether or not themain relay 202 is in the fault state where it cannot be controlled tothe off state.

In the above described embodiments, the microcomputer and the soak timerare separately formed in different IC chips, however they may beintegrated in the same IC chip (microcomputer chip) as a control sectionand a timer section, respectively, as shown in FIG. 16.

The above explained preferred embodiments are exemplary of the inventionof the present application which is described solely by the claimsappended below. It should be understood that modifications of thepreferred embodiments may be made as would occur to one of skill in theart.

1. A method of diagnosing presence of a fault in a main relay by use ofan electronic control unit including a control section monitoring amanipulation of an ignition switch of a vehicle, and a timer section forautomatically starting up said control section, said electronic controlunit being configured to control said main relay to an on state forsupplying said control section with electric power from a vehiclebattery when said ignition switch is turned on or when said timersection in which a predetermined start-up set time is set is timed up,and to control said main relay to an off state in accordance with a stopcommand outputted from said control section, said method comprising thesteps of: monitoring, by use of said control section, a state of anelectric load connected to said electronic control unit and suppliedwith electric power from said vehicle battery when said main relay is inthe on state after said control section outputs said stop command; anddiagnosing whether or not said main relay is in a fault state where saidmain relay cannot be controlled from the on state to the off state onthe basis of monitored state of said electric load.
 2. The methodaccording to claim 1, wherein said monitoring step includes making anattempt to drive said electric load by use of said control section tomonitor operation state of said electric load when said attempt is made.3. The method according to claim 2, wherein said stop command outputtedfrom said control section is inputted to a drive circuit of said mainrelay by way of said timer section, and said attempt is made utilizing atime period after transmission of said stop command from said controlsection to said timer section.
 4. The method according to claim 2,wherein said stop command outputted from said control section isdirectly inputted to a drive circuit of said main relay, and saidattempt is made utilizing a time period after transmission of said stopcommand from said control section to a drive circuit of said main relay.5. The method according to claim 4, wherein said monitoring step furtherincluding, if said electric load is normally driven when said attempt ismade, making said attempt for the second time, and said diagnosing stepincluding determining that said main relay is in said fault state ifsaid electric load is normally driven when said attempt is made for thesecond time.
 6. The method according to claim 2, further comprising thestep of making, if said electric load is normally driven when saidattempt is made, a diagnosis of presence of a breakage fault in a powersupply path of said electric load on the basis of followability of saidelectric load to said drive command.
 7. The method according to claim 2,further comprising the step of making, if said electric load is normallydriven when said attempt is made, a diagnosis of presence of a breakagefault in a power supply path of said electric load on the basis of avalue of a current flowing into said electric load through said powersupply path.
 8. The method according to claim 2, wherein said monitoringstep includes monitoring a time elapsed since said control sectiontransmits said stop command by use of said control section, said attemptbeing made when said monitored elapsed time exceeds a threshold time setat a value determined depending on a response time needed for said mainrelay to change from the on state to the off state in response to saidstop command.
 9. The method according to claim 8, wherein said thresholdtime is equal to a sum of said response time and a predetermined margintime.
 10. The method according to claim 1, further comprising the stepof, when a diagnosis that said main relay is in said fault state,notifying a result of said diagnosis, and storing said result of saiddiagnosis in a nonvolatile memory included in said electronic controlunit.
 11. The method according to claim 1, wherein said control sectionand said timer section are separately formed in different IC chips. 12.The method according to claim 1, wherein said control section and saidtimer section are integrated in the same IC chip.
 13. An electroniccontrol unit comprising: a control section monitoring a manipulation ofan ignition switch of a vehicle; and a timer section for automaticallystarting up said control section; said electronic control unit beingconfigured to control said main relay to an on state for supplying saidcontrol section with electric power from a vehicle battery when saidignition switch is turned on or when said timer section in which apredetermined start-up set time is set is timed up, and to control saidmain relay to an off state in accordance with a stop command outputtedfrom said control section, and being provided with a fault diagnosisfunction of monitoring, by use of said control section, a state of anelectric load connected to said electronic control unit and suppliedwith electric power from said vehicle battery when said main relay is inthe on state after said control section outputs said stop command, anddiagnosing whether or not said main relay is in a fault state where saidmain relay cannot be controlled from the on state to the off state onthe basis of monitored state of said electric load.
 14. The electroniccontrol unit according to claim 13, wherein said fault diagnosisfunction is configured to make an attempt to drive said electric load byuse of said control section to monitor an operation state of saidelectric load when said attempt is made.
 15. The electronic control unitaccording to claim 13, wherein said stop command outputted from saidcontrol section is inputted to a drive circuit of said main relay by wayof said timer section, and said fault diagnosis function is configuredto make said attempt utilizing a time period after transmission of saidstop command from said control section to said timer section.
 16. Theelectronic control unit according to claim 14, wherein said stop commandoutputted from said control section is directly inputted to a drivecircuit of said main relay, and said fault diagnosis function isconfigured to make said attempt utilizing a time period aftertransmission of said stop command from said control section to a drivecircuit of said main relay.
 17. The electronic control unit according toclaim 16, wherein said fault diagnosis function is configured to make,if said electric load is normally driven when said attempt is made, saidattempt for the second time, and to determine that said main relay is insaid fault state if said electric load is normally driven when saidattempt is made for the second time.
 18. The electronic control unitaccording to claim 14, wherein said fault diagnosis function isconfigured to make, if said electric load is normally driven when saidattempt is made, a diagnosis of presence of a breakage fault in a powersupply path of said electric load on the basis of followability of saidelectric load to said drive command.
 19. The electronic control unitaccording to claim 14, wherein said fault diagnosis function isconfigured to make, if said electric load is normally driven when saidattempt is made, a diagnosis of presence of a breakage fault in a powersupply path of said electric load on the basis of a value of a currentflowing into said electric load through said power supply path.
 20. Theelectronic control unit according to claim 14, wherein said faultdiagnosis function is configured to monitor a time elapsed since saidcontrol section transmits said stop command by use of said controlsection, said attempt being made when said monitored elapsed timeexceeds a threshold time set at a value determined depending on aresponse time needed for said main relay to change from the on state tothe off state in response to said stop command.
 21. The electroniccontrol unit according to claim 20, wherein said threshold time is equalto a sum of said response time and a predetermined margin time.
 22. Theelectronic control unit according to claim 13, wherein said faultdiagnosis function is configured to, when a diagnosis that said mainrelay is in said fault state is made, notify a result of said diagnosis,and store said result of said diagnosis in a nonvolatile memory includedin said electronic control unit.
 23. The electronic control unitaccording to claim 13, wherein said fault diagnosis function isconfigured to, when a diagnosis that said main relay is in said faultstate is made, transmit a result of said diagnosis as a fail-safecommand to other electronic control units through an in-vehicle network.24. The electronic control unit according to claim 13, wherein saidcontrol section and said timer section are separately formed indifferent IC chips.
 25. The electronic control unit according to claim13, wherein said control section and said timer section are integratedin the same IC chip.